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Abstract 

In this paper, we focus on a special framework for quantum coin flipping protocols, bit- commitment 
based protocols, within which almost all known protocols fit. We show a lower bound of 1/16 for the 
bias in any such protocol. We also analyse a sequence of multi-round protocol that tries to overcome 
the drawbacks of the previously proposed protocols, in order to lower the bias. We show an intricate 
cheating strategy for this sequence, which leads to a bias of 1/4. This indicates that a bias of 1/4 might 
be optimal in such protocols, and also demonstrates that a cleverer proof technique may be required to 
show this optimality. 

1 Quantum coin flipping 

Coin nipping is the communication problem in which two distrustful parties wish to agree on a common 
random bit, by "talking over the phone" pi. When the two parties follow a protocol honestly, the bit 
they agree on is required to be or 1 with equal probability. Ideally, they would also like that if any 
(dishonest) party deviates from the protocol, they do not agree on any particular outcome with probability 
more than 1/2. It is known that ideal coin flipping is impossible, in both, the classical and the quantum 
setting go], 0]. In fact, in any classical protocol, one of the two parties can force the outcome of the 



protocol to a value of her choice with probability 1. In M, Aharonov, Ta-Shma, Vazirani, and Yao showed 
that it is possible to design a quantum coin nipping protocol in which no player can force the outcome of 
the protocol with probability more than a constant 1/2 + e, with bias a constant e < 1/2. In other words, 
any cheating player in such protocols is detected with constant probability. Later, Ambainis [Q] gave an 
improved protocol with bias at most 1/4. 

Formally, a quantum coin nipping protocol with bias e is a two-party communication game in the style 
of [jOJ, in which the players start with no inputs, and compute values ca,cb £ {0,1} respectively (or 
declare that the other player is cheating). The protocol satisfies the following additional properties: 

1. If both players are honest (i.e., follow the protocol), then they agree on the outcome of the protocol: 
ca = cb, and the outcome is or 1 with equal probability: Pr(cA = cb = b) = 1/2, for b 6 {0, 1}. 
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2. If one of the players is honest (i.e., the other player may deviate arbitrarily from the protocol in his 
or her local computation), then the outcome of the protocol has bias at most e: for any b E {0, 1}, 
Pr(c A = c B = b) < 1/2 + e. 

Almost all quantum coin flipping protocols with bias that is provably smaller than a half Jl], || are based 
on the notion of bit-commitment. In other words, they have the following form, when the parties flipping 
the coin, Alice and Bob, are honest.Q 

Protocol schema II: 

1. First, Alice and Bob each pick a random bit, a and b respectively, and privately construct states p a 
and a?,. The states are over three sets of qubits, a commitment part, a revelation part, and a 
verification part. The revelation part consists of one qubit that contains the value of the bit picked. 

2. Next, they commit to their respective bits a and b, by sending each other the commitment part of 
their states p a and a^. They may do this over several rounds of communication, in which they send 
messages alternately. 

3. Then, they reveal to the other party the bits a, b they picked (in some order), and follow that up by 
sending the rest of the states p a , (the verification part). This may again be over several rounds of 
communication. This allows the each party to check via suitable measurements that the state with 
which the other, Alice (or Bob), committed to her (his) bit is indeed consistent with a (b). 

The result of the protocol is c = a © 6, if neither player is detected cheating during the third (verification) 
stage. 

For example, in the case of the protocol in [^], Alice uses the right half of the following state to commit to 
her bit a, and the left half to help Bob check her commitment: 

Pa = ^ -|a,s)(a, s| (8) l^sX^sl, where 

s=0,l 

hM = -^(|o> + (-in* + i». 

Bob skips the commit stage, and directly reveals his bit b. In the final stage, Bob checks that the state of the 
qutrit Alice sent in the first round is indeed consistent with a, s, by measuring it in a basis containing \ip a ,s)- 

Protocols of the form described above may be recast in the following terms. First, Alice and Bob each 
pick a random bit. Then, they successively send each other qubits which do not depend on the qubits sent 
by the other party in the previous rounds. The qubits sent by Alice represent a commitment to her bit a 
along with auxiliary information required by Bob to check if she is cheating. Similarly for the qubits sent 
by Bob. Thus, after all communication is over, the states Alice and Bob sent to each other for and 1 
are perfectly distinguishable. They measure the states received from the other party (possibly with some 
ancilla) according to a von Neumann measurement to determine the bits a, b or to detect cheating. The 
outcome of the coin flip is a©6 if no cheating is detected. In this description, we have assumed, w.l.o.g. §, 
that all measurements are done at the end. Note that the description is also slightly more general in that 
the players may not explicitly reveal the bits they intend to commit to, and the commitment and the 

*We were recently informed [O] of a protocol of a different kind that also achieves a bias of 1/4. 
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verification stages may be interleaved. We will henceforth refer to such protocols as bit- commitment based 
protocols. 

In this paper, we study coin flipping protocols that fall into the special framework described above, that 
of bit-commitment based protocols. We show a lower bound of 1/16 for the bias in any such protocol 
(Theorem |2.2| ), This provides a single proof that these protocols, including the one proposed in Jl2[ |, 
cannot lead to arbitrarily small bias. 

Next, we analyse a sequence of protocols that tries to overcome the drawbacks of the previously proposed 
protocols, and also tries to circumvent the cheating strategy that leads to this above lower bound. We show 
an intricate cheating strategy for the sequence of protocols, which leads to a bias of 1/4. This indicates 
that a bias of 1/4 might be optimal in such protocols, and also demonstrates that a cleverer proof technique 



than the one used in Theorem 2.2 is required to show this optimality. 

Recently, Kitaev has shown a lower bound of l/\/2 — 1/2 = 0.2071 . . . for the bias in arbitrary quantum 
coin flipping protocols Q. This is bigger than the bias of 1/16 = 0.0625 that we show (and applies to any 
coin- flipping protocol). Kitaev's lower bound, however, doesn't seem to apply to quantum games in which 
the two parties involved compete to "win" by getting a particular value of the coin as the outcome (say 
Alice wins if the outcome is 0, and Bob wins if the outcome is 1). This is also known as weak coin-flipping in 
the literature. Protocols for weak coin-flipping with bias less than 1/4 have been discovered. Kerenidis and 
Nayak || have shown a protocol with cheating probability at most 0.739. . .. Ambainis ||, and Spekkens 
and Rudolph [[lj] have shown protocols with an even lower cheating probability of at most l/\/2 = 0.707 .... 



2 A lower bound on the bias 

We first show that any bit-commitment based protocol may be reduced to an extremely simple protocol of 
the same type, with bias at most that in the original protocol, and by increasing the number of rounds by 
at most 1. 

Lemma 2.1 For any bit- commitment based coin flipping protocol V (of the form II, or more generally, as 
described in Section [7p, there is another such protocol V such that 

1. The states p a ,o~b are pure: p a = \ip a ){ipa\ and Ob = \4>b)(4>b\, where |V>o) -L IV'i) an d l^o) -L \4>i)> 

2. Alice measures the state she received from Bob according to the measurement given by the opera- 
tors Pq = \(po)(4>o\, Pi = \4>i)(4>i\, and P c = I — P$ — P\, to determine Bob's bit or to check if he 
is cheating. Bob does an analogous measurement given by Qo,Q\,Q c on the state he receives from 
Alice, and 

3. The bias is at most the bias ofV. 

Proof: The protocol V' is obtained by stipulating that the players use a fixed purification \ip a ), \4>b) of 
the states p a ,o~b used in the original protocol V . Since the states po,Pi are perfectly distinguishable, their 
purifications are orthogonal. Similarly with 0o 5 <f>i- All but the last two rounds of V' are as in the original 
one. We stipulate that the players send the entire (purified) state ip a or 0& in V' . Thus, the last player to 
send a message in V sends the qubits used in the purification in the penultimate round of V' . In the final 
round, the other player sends the qubits used in purifying her state. We also alter the measurement to the 
ones mentioned in the lemma. 
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We now show that this modification of the protocol results in bias at most that in the original one. We do 
this by showing that any cheating strategy of a player in the modified protocol V' that achieves a bias of e 
leads to a cheating strategy in the original protocol V with at least the same bias. 

For concreteness, we consider a cheating strategy for Alice in the protocol V' . (The argument for the case 
of Bob is similar.) In her strategy in V, Alice acts exactly as in the original strategy, except that she is 
not required to send the "purification qubits" meant for her last message in V' . We need only show that 
the probability with which the measurement in V yields or 1 dominates the same probability for V' . 

Suppose that Bob uses a von Neumann measurement given by the projection operators R§,R\,R C in V. 
We concentrate on the probability that Alice can convince Bob that she had picked a = 0. The other 
probability may be bounded similarly. Since RopoRo = po, the purification l^o) lies in the range of /(g) Ro. 
The states of the qubits sent to Bob by Alice and her private qubits in V' are together given by some 
mixed state J2j /^j I I (where the states are over the space of p a and the purification space). It thus 
suffices to show that for any state |£) E 

\\I®R \0\\ 2 > \(M0\ 2 - 

Note that the LHS is the squared-norm of the projection of |£) onto the range of / <g> Rq, and the RHS is 
the squared-norm of the projection of the same vector onto a subspace of that range, the one-dimensional 
space spanned by l^o)- The inequality is then immediate. This shows that Alice can achieve at least the 
same bias as inV. ■ 

This simple characterisation of bit-commitment based protocols proves useful in the analysis of the small- 
est bias achievable with such protocols. Using this, we show that coin flipping protocols based on bit- 
commitment cannot achieve arbitrarily small bias. 



Theorem 2.2 In any quantum coin flipping protocol based on bit- commitment, one of the parties can 
achieve probability of cheating at least 9/16. 



Proof: As shown in Lemma 2.1, any such protocol between honest parties may be viewed as follows: 
first, Alice and Bob construct the states \if> a ) and \4>b), respectively, corresponding to the random bits a 
and b. Then, they send each other a part of the states \if) a ), \<t>b) a f ew qubits at a time. Finally, they 
measure the qubits received from each other using projections Po, P\, P c and Qo,Qi,Qc- 

Let p a) i = TiA i (\'4'a}('4'a\) be the state sent to Bob by Alice by round i (so Ai are the qubits of \ip a ) still 
with Alice after the i-th round). Let cr^j be the corresponding state sent to Alice by Bob. 

Let there be n rounds in all. Let Fa,% = F(po,i, Pi,i) and similarly Fs,i = F(ao t i,ai t i). Here, F(-, •) is fidelity 
function as defined in §. So F A ,o = F Bfi = 1. Note that Q 

aPa,n^4 a — Pa,m 

and similarly PbO~b t nPb = c"6 

so that F A , n = F B , n = 0. 



n i 



Lemma 2.3 Consider a protocol with honest players. For any constant < a < 1, there is a player, say 
Alice, and a round k > such that the states she sends to Bob by the k-th round on a = and 1 have 
fidelity at least a, and the fidelity of the states she receives from Bob by the next round have fidelity at 
most a. In other words, F A ,k > ct and Fs,k+i < ct. 

Proof: The case a = 1 is trivial. Let a < 1. Note that both Fa,i,Fb^ decrease from 1 to through 
the course of the protocol. Consider the first round i > 1 such that one of these, say Fb,%, becomes < a. 
Round k = i — 1 satisfies the property we seek. ■ 
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We will devise a cheating strategy for a player as given by Lemma 2.2 above for a = 1/4. Say this player 
is Alice, and the round identified in the lemma is k. There is a unitary transformation on the qubits A k 
which achieves maximum fidelity between po t k,Pi,k 0) i-e., 

\{MUWi)\ 2 = F A , k = F(p ,k,Pi,k) > \- 

Moreover, we may assume that (V'ol^lV'i) is rea l an d non-negative. 
Alice may cheat as follows. She constructs the state 

|| ifo + Ufa || 

and uses this state in the protocol till round k + 1. After this round, she makes the best possible measure- 
ment to distinguish oo^+i and ci^+i to guess the value of b. If her guess g is 0, she proceeds with the 
rest of the protocol, Otherwise, she applies to her part of |£) (the qubits in Ak) and then completes the 
protocol. 

Lemma 2.4 Pr(c = 0\g = b) > 1+ ^ A > k . 

Proof: First, note that 

Uo + U^W 2 = ||Vo|| 2 + HV>i|| 2 + 2(V>olWi> = 2 (1 + \fFZk)- 

Suppose 6 = 0. (The other case is similar.) Note that the probability that Alice succeeds in getting the 
outcome c = given that she guesses the value of b correctly is 

ii^ 1 1,2 II QoV>o + QoUih. f _ IIQo^o|| 2 + ||Qo^i|| 2 + 2(Vo|Qof/|^i) 
^o? II — — — — — , l|2 — 



llVo + ^if 2(1 + /^) 

Now Qo\ipo) = \ipo), since \ipo) is the state Alice would have used if she were honest. So the first term in 
the numerator above is 1, and the last term is 2-y/F A k- The second term may be bounded from below 
by noting that since \ipo) belongs to the range of Qo, the square-norm of the projection QoU\ipi) is at 
least (tfjolUlipi) 2 = Fa,u- Thus, the probability of cheating is at least 

1 + F Ayk + 2y^ = l + ^FX k 
2(1 + JF^k) 2 

which is the bound claimed. ■ 

The probability that Alice correctly guesses b is (using Bayes' strategy) 

Pr(g = b) = - + a. 

By a result of Fuchs and van de Graaf |1 , 



II co,fc+i — fi,fc+i || tr - 2(1 - ^F B ,k+i) > 2(1 — -) = 1. 
The net probability that Alice succeeds in biasing the coin towards is therefore 

Pr(c = 0) > Pr(c = 0\g = b) ■ Pr(g = b) > --~ A = 

4 4 lb 



This proves the theorem. 
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3 A sequence of highly interactive protocols 



In this section we look at a sequence of bit-commitment based protocols in which Alice and Bob very 
gradually send each other information about their bits in the commit stage. Intuitively, such protocols 
seem to be good candidates for achieving bias much smaller than 1/4, since a dishonest player does not get 
much information about the other's bit until a significant number of rounds have elapsed, and he would 
have heavily committed to some bit by then. However, this intuition appears to be mistaken, and we give 
intricate cheating strategies for each of the players with which at least one of them can achieve bias at 
least as high as 1/4. This suggests that the optimal bias for this kind of protocol might be 1/4, and also 
that proving this optimality might require ideas more sophisticated than those in Theorem |2.2| . 

Define, for x,s £ {0, 1}, 

mx,s)} = v / r^io) + (-i) s ^ix + i). 

These states provide the best trade-off between how much information they reveal, and how much cheating 
in commitment they allow. 

The protocol V n , n G {1,2,3,...}, goes as follows. Alice picks a Gr {0,1}, and Bob picks b Gr {0,1}. 
Then they alternately send each other, for a total of n rounds, the states \i/j(a, s)} and \ip(b, s)) respectively, 
for independently chosen random sign s, starting with Alice. The last player to receive such a state then 
reveals the bit he/she chose, followed by the other player. Then, they reveal the signs used in their states 
in the opposite order, and the other party checks the state he/she received against the claimed bit and 
sign. If no cheating is detected, the players declare the c = a © b as the result of the protocol. 

More formally, 

1. For i = 1, 2, 3, . . . ,n, if i is odd, Alice picks Sj Gr {0, 1}, and sends \if)(a, s«)) to Bob, else, if % is even, 
Bob picks Si Gr {0, 1}, and sends \tp(b, Si)) to Alice. 

2. If n is even, Alice sends a to Bob, and then Bob sends b to Alice. Otherwise, if n is even they reveal 
their bits in the opposite order. 

3. For % = n, n — 1, n — 2, . . . , 1, the player that picked Sj reveals it to the other player. In other words, 
the "signs" used in the states are revealed in the opposite order: If i is odd, Alice sends Sj to Bob, 
else Bob sends Si to Alice. The player that receives this bit checks via a measurement that the state 
sent to her/him in the i-th round of the protocol is indeed consistent with the bit and the sign that 
the other player sent. 

Note that the order of revealing signs is designed so that the naive strategy of reusing a state that a 
player got in a previous round does not work. 

4. If all the checks are passed, the outcome of the protocol is c = a © b. 

Before we give cheating strategies for these protocols, we analyse general versions of V\ and Vi ■ This 
illustrates the main approach taken in the strategies for V n , n > 3. 

3.1 The three-round version 

We start by analysing the protocol V\ with one round of commitment. This happens to be a parametrised 
version of the three-round protocol due to Ambainis Q. We prove a property of this protocol that helps 
us analyse protocols with more rounds. 
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The protocol may be described with a parameter a G [0, n] (such that tan ^ = ) as: 

1. Alice picks a, s Gr {0, 1}, and sends Bob the state \ip a>s ), where the state is defined as follows: 

|W> = cos||0) + (-irsin||a + l). (1) 

2. Bob picks b Gr, {0, 1} and sends it to Alice. 

3. Alice then reveals the bits a, s to Bob, who checks for consistency with the state initially sent by 
Alice. 

The output of the protocol is given by c = a © b, if all the checks are passed. 
Lemma 3.1 If Bob is honest, then Pr(c = 0) < 4(3 + cos a). 

Proof: The analysis proceeds as in pi, by symmetrising the strategy of a dishonest Alice, so that in the 
last round, she sends s = and s = 1 with equal probability, and assuming that she always sends a = b 
(this only increases her chances of cheating successfully). For such a symmetric strategy, Ambainis |||, 
Lemma 8] shows that 

Pr(c = 0) < gWl+jW) , (2) 

where p is the state of Bob after the first round, and po, pi are the analogous states corresponding to b = 0, 1 
respectively, if Alice were honest: 

Pa = 2(1^0X^0,0! + I^iXVmI)' 
and F(ao, 0"i) = || ^/&o^/(Tl ||^ r denotes the fidelity of two density matrices 0. 



We show in Lemma 3.2 below that the expression in equation (|2p is bounded above by 

i(l + F( P0 ,Pi) 1/2 ). 

Since F(po,pi) = cos 4 ^, the bound follows. ■ 
We now prove the lemma mentioned above. 

Lemma 3.2 For any two density matrices o"o,o"i, 

max F(a ,a) + F(a 1 ,a) < 1 + F(a , en) 1 / 2 . 

(7 

Proof: Let a be the density matrix that achieves the maximum, and let \(p x ) be a purification of a x , 
for x = 0,1. Let be the purification of a that achieves maximum fidelity with a x @: 

F(a ,a) = K^IUI 2 - 
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Since |£o)j are the purifications of the same density matrix cr, there is a local unitary operator U such 
that = U\£ ). Now, 



F(a ,a)+F(a 1 ,a) = \(Mto)\ 2 + |<0i|£i>| 2 

= \(M&\ 2 + mum 2 

< max|(<Ao|O| 2 + |(0i|C/|O| 2 





= l + \(<h\U\<h)\ (3) 
< 1+ max |(^|C7|0o)| 

local U 

= 1+F(ct ,cti) 1/2 . (4) 

Equation (^) above follows by noticing that the state |£) that achieves the maximum is the vector that 
bisects the angle between |(^>o) and ?7|i^i). Another way of getting the bound is by noticing that the 
expression is the maximum eigenvalue of the matrix |^o)(0o| + U\(f>i)((j)i\U^ . The last step — equation @)~ 
follows from a characterisation of fidelity due to Jozsa M. ■ 



3.2 The five-round protocol 

Next, we give a tight analysis for a general five-round version of the protocol Vi described above. This 
version of the protocol still does not improve over the bias of 1/4 achieved by the three-round protocol 
of P|. However, it suggests a better cheating strategy for the many-rounds version than the one given in 
the proof of Theorem |2,2[ 

The version of the protocol Vi we consider has the following five rounds with honest players: 



1. Alice picks a, s Gr {0, 1}, and sends Bob the state \tp a ,s), where the state is defined as follows: 

Wm> = co S f|0 ) + (-l)' S m|| O + l), (5) 

for an angle a to be specified later. 

2. Similarly, Bob picks b, s' Sr {0,1} and sends Alice the state \4>b,s'), where the state is defined as 
follows: 

\M = cos^|0) + (-ir'sin^|6+l), (6) 

for an angle (3 to be specified later. 

3. Alice then reveals the bit a to Bob. 

4. Bob reveals both b and s' to Alice, and Alice verifies, by an appropriate measurement, that the state 
sent by Bob is consistent with b, s' . 

5. Alice now discloses s as well, and Bob verifies that the state sent by Alice in the first round is 
consistent with a, s. 
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The output of the protocol, the coin flip c, is given by the exclusive-or of two bits, c = a (Bb (provided no 
cheating is detected). 

In the case the players are honest, Pr(c = 0) = Pr(c = 1) = 1/2. Below we prove an upper bound on the 
probability that any player can achieve (by deviating from the protocol) for an outcome of their choice. In 
the following discussion, we will assume, w.l.o.g., that a dishonest player prefers the outcome c = 0. 

First, we prove a bound on the probability that a dishonest Bob can achieve, provided Alice is honest. 
Lemma 3.3 If Alice is honest, then Pr(c = 0) < 1 — | cos 2 ^ sin 2 ^. 

Proof: We claim that Bob's optimal cheating strategy is to measure the state received from Alice in the 
standard basis, and then commit to a state according to the outcome. If he observes |1) or |2), he can 
cheat with probability 1 in the rest of the protocol. In case he observes |0), his probability of cheating 
successfully is bounded by a constant less than one. This gives us the bound, as explained below. 

Note that the last round is of no consequence to Bob's cheating strategy, and we may trace the sign bit s out 
after Alice sends the first message (and eliminate the last round). The protocol then becomes equivalent 
to one in which the first round takes the following form: 

Alice picks b Gr {0, 1}, and sends |0) with probability cos 2 and |6 + 1) with probability sin 2 ^. 

This reduces the protocol to a convex combination of two protocols, with weights cos 2 ^ and sin 2 ^. In the 
first protocol, the first message is the same regardless of the value of b, and in the second, the first message 
reveals b entirely. 



In the first case, the protocol reduces to a three-round protocol of the type studied in Section |3.1| , with the 
role of Alice and Bob reversed. We may now use Lemma |3.l| to bound the probability that Bob can cheat 
by (3 + cos/?)/4. 

In the second case, the protocol becomes trivial, and Bob can cheat with probability 1. 
The probability of convincing Alice that c = is thus bounded by 

3 + cos (3 2 a i a 

cos - + sm -, 

which reduces to the bound we seek. ■ 

Bob can easily achieve the probability bound stated in the lemma, by following a cheating strategy as in (2|, 
Lemma 10]. This shows that the analysis in our proof is optimal. 

We now turn to the case where Alice is dishonest. The following lemma bounds Alice's cheating probability. 
Lemma 3.4 // Bob is honest, then Pr(c = 0) < ^(1 + cos 2 ^ sin 2 §). 

Proof: If Alice is dishonest, she tries to force the outcome c = by guessing the bit that Bob picked, 
and then convincing him that the state she sent is consistent with that guess. 

We begin by symmetrising Alice's strategy so that the density matrix of the qutrit she commits to in the 
first round is diagonal in the 0,1,2 basis. This is done in a manner as in in [||, Lemma 6]; we omit the 
details. We may therefore assume, w.l.o.g., that the joint state of Alice and Bob after the communication 
in the first round is 

10 = v / A^|0,0) + ^|l,l) + ^|2,2), 
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where A$ = 1 and the density matrix of Bob's part is 

p = A |0)(0| + Ai|l)(l| +A 2 |2)(2|. 

Alice's strategy in the third round is given by some measurement on her entangled qutrit, the qutrit sent 
by Bob, and some ancilla. This measurement gives the value of the bit she sends to Bob in that round. 
We consider the superoperator T acting on their joint state consisting of this measurement, composed with 
the tracing out of all subsystems except the bit sent in that round, and the qutrit sent in the first round. 
This superoperator is determined entirely by its action on (g) f° r * = 0, 1> 2, since the qutrit sent 

by Bob is a mixture of the states Let 

r(|t'X«l® lexei) = |o)(o|®p io + |i)(i|<»Pii, 

where J2j Pij = P- Thus, the unnormalised density matrix of the qutrit Alice sent in the first round is: 

2/3-2/5 ln s 
cos - p ob + sm - p b +i,b, (7) 

given that Bob had picked bit b, and Alice's guessed it correctly: a = b. 

Let pij be the state, diagonal in the 0, 1, 2 basis, obtained by measuring the state p^, and let: 

poo = diagOo,/ii, A 2 - P2) 

pox = diag(A - poAl -Pi,P2), 

where < pi < \. Finally, let pb = cos 2 f p~ob + sin 2 ^ p~b+i,b be the state (0) measured in the 0, 1, 2 
basis. Let Ob be the density matrix of the qutrit Alice would send in the first round, if she were honest, 
and had picked the bit b: 

a b = cos 2 I |0)(0| +sin 2 | 

Assume now that instead of having picked s' at random, Bob had created a uniform superposition over 
the two possible values for the sign bit, and that he sends the qubit containing s' in the fourth round. It 
is now not hard to prove (cf. [|j) that the probability that (the dishonest) Alice is able to convince Bob 
that the state she sent is consistent with b, is at most F(pb,(Tb)- This probability is thus also bounded 
by F(a b ,cr b ), where 

^0 = cos 2 ^ (mo|0}(0| +Ai|1)(1|) + sin 2 ^ p 

H = cos 2 ^ ((A -/i )|0)(0| +A 2 |2)(2|) + sin 2 ^ p. 

In other words, it only helps Alice to claim that she sent a state corresponding to bit b if she either sees 6+ 1 
in the qutrit she receives from Bob, or if she sees and had sent the state |6 + 1) to Bob in the first round. 

By optimising over the choice of po for fixed Aj and then optimising Aj, we see that the optimum 
of F(ao, cro) + F{p\, (T\) is achieved when 

Po 

Ai 
A 2 



Aq(Ai - A 2 sin 2 |) 
(A 1 + A 2 )cos 2 f ' 

> A2 sin 2 ^, and 

> Ai sm — . 
2 
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We thus get the following bound on Alice's cheating probability: 

1 f, , —2 a ■ 2 



-(1 + cos — sin 
2 V 2 2 



which is the bound claimed. 



Next, we describe a cheating strategy for Alice that achieves the outcome of her choice with probability as 
high as in the upper bound above, showing that our analysis is optimal. 

Lemma 3.5 If Bob is honest, Alice can achieve Pr(c = 0) > ^(1 + cos 2 § sin 2 ^). 

Proof: Alice constructs the following entangled state and sends one half of it to Bob in the first round: 

|£> = vT^A|0,0) + ^|l,l)+^|2,2), where 



(1 + sin 2 §) cos 2 § + sin 2 § ' 



2 / 2 * Dl - Ll - 2 

and so the density matrix of the qutrit with Bob is p = diag(l — A, A/2, A/2) in the 0, 1, 2 basis. 

After Alice receives a qutrit from Bob in the second round, she applies a unitary transformation to "guess" 
a value for b to maximise her chances of getting c = 0. This transformation acts on the qutrit she received 
from Bob, her entangled qutrit from the first round, and an ancilla qubit. It can be written as: 

|0)(0|®(|0)(0|<g>#+|lXl|®/+|2)(2|®<7 x ) + |1)(1|®/®I + |2)(2|®I®<j x . 

where H is the Hadamard transform, and a x is the Pauli "bit flip" matrix. In other words, Alice guesses a = 
b, if the qutrit from Bob reveals the identity of b. Otherwise, if she committed with a \d), (d = 1,2) she 
says a = d — 1, since this commitment is irrevokable. If she committed with |0), she says a = 0, 1 with 
equal amplitude. It is crucial that she does this in superposition. 

In the fourth round, Bob reveals the state of the qutrit he sent. If Alice sees that the bit Bob picked is 
different from her guess, i.e. b ^ a, then she sends, say, s = (an arbitrary value, since she has lost the 
game). Otherwise, she tries to pick the best s possible to maximise her chance of passing Bob's check. We 
describe her actions when b = 0, s' = 0; the other cases are similar. 

The unnormalised density matrix of the qutrit she sent in the first round, when b = 0, s' = 0, conditioned 
on her reply being a = is: 



cos 2 f (1^ 10X01 + £|1X1|) + sm 2 fp. 



Note that she knows the state of all their qubits, given b, s' , a. She can thus transform her part of the state 
so that their joint state looks like 



^( 1 + S tff)|00> + ^|11) + ^sinf|22). 

She sends s = if the entangled bit is 2. If her entangled qutrit is not 2, she does a Hadamard transform 
on her entangled qubit, and sends that to Bob as s. The probability with which Bob accepts a = b, s is 
then 
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which evaluates to the expression stated in the lemma. She can achieve the same probability of success for 
all other values of b, s' as well. Thus, the overall chance of her succeeding in cheating is also given by this 
expression. ■ 

The properties we established above show that this protocol still has a bias of 1/4: the cheating probability 
for Alice and Bob are of the form ^ + <5 and 1 — 5 respectively (with S = i cos 2 ^ sin 2 5), and their maximum 
is minimised when 5 = 1/4. 



3.3 Cheating strategies for V n 

Let A n (e), B n {e) be the maximum value of Alice and Bob's cheating probability in the protocol V n , when 
the other party is honest. 



Bob's optimal strategy may be reduced to a strategy for Alice as in the proof of Lemma 3.2. Alice always 
starts the protocol, and also sends the last message. Since the last message does not affect Bob's cheating 
strategy, we may trace it out of the protocol when analysing his optimal strategy. The protocol V n then 
reduces to a mixture of protocols where Alice sends |0) in the first round with probability 1 — e (i.e. does 
not reveal any information about the bit a), and sends \a + 1) with probability e (i.e. completely reveals 
the bit a). The rest of the protocol is the same as V n -\ with the roles of Alice and Bob reversed. Thus, 

B n {e) = e + (l-e)A n _ 1 (e), for n > 2. (8) 

We already know from |2j that B\(e) = (1 + e)/2. It thus suffices to analyse Alice's cheating probability in 
all the protocols V n . 

From our analysis of the three and five round protocols, we also know that 

aw = i-f + f 

w 2 2 2 

We now give a lower bound for the probability A ri {e) by describing a cheating strategy for Alice that 
generalises the strategy that we saw in the five round protocol. 

First, we assume n = 2k — 1 (k > 1) is odd, so that Alice has k rounds of commitment, and Bob has k — 1. 
The case of n even is addressed later. In the first round, Alice sends one half of the state 



VT^aTIoo) + y^|ii) + y^|22) 



to Bob, and retains the other half. The half she keeps is referred to as an "entangled qutrit" below. All the 
parameters Xj will be specified later. If one of the entangled qutrits she retains from any previous round 
is in state x + 1, in all the commitment rounds that follow, she sends the right half of the state 

-L|0)h/>(*,0)) + -±=|i)|#M)) 
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and keeps the first qubit (called a "sign qubit" below). If the entangled qutrits are all 0, and at least one 
of the qutrits she received in earlier rounds from Bob is in state 6+1, then she sends the right half of the 
state 

-L 10)1^(6, o)> + i=|iMM)) 

to Bob. Otherwise, if none of the above two events occurs, she sends one half of the state 




in the j-th commitment round. It is important that she do all this "in superposition," i.e., via unitary 
operations controlled by her entangled qutrits and the qutrits she receives from Bob. She performs no 
measurements in the process. 

Formally, for each qutrit that Alice is supposed to send, she has a qutrit-qubit pair. The first serves as the 
"entangled qutrit" , and the second serves as the "sign qubit" . They are all initialised to the state. She 
prepares appropriate states over these according to the above rules, as the protocol proceeds. The joint 
state of both parties together after the n commitment rounds then looks as given below, for an arbitrary 
choice of b and the signs {s2j} picked by Bob. Here, the qutrits sent by Alice to Bob are underlined. The 
entangled qutrits and sign bits can be identified from the context. The first two lines correspond to the 
part of the state where Alice commits to a bit x by sending \x + 1), before she can identify which bit b Bob 
has picked. The next two lines have the part of the state where Alice has not committed to any bit, and 
sees a \b + 1) in one of the qutrits Bob sent. The last term is the remaining part of the state. Note that 
Alice can differentiate between these three parts by examining her entangled qutrits and the qutrits Bob 
sent her. The odd lines contain the portion of the state constructed by Alice, and the even lines contain 
the portion prepared by Bob (and sent to Alice). 



+ 



k-1 

E E 

x=0,l j=l 



3-1 




-f\x + l,x±l) 



1 



— (10)1 ^0) ) + 



"1 k-j 



(g)(vT^|o 



3-1 



k-1 



m, S2l )) 



k-1 

+ E 

3=1 



i=i 



-^(|0MM)) + |iMM)» 



k-j 



(9) 



(VT^|0)) 3 1 0[(-l) s ^Ve\b+l)] 



k — l 

<S> MM2i)> 

'=3+1 



k-1 



VT^a^ |oo) + a/^ IU) + V ^ |2 - } 



(Vr^io)) 



fc-1 



Since n = 2k — 1 is odd, Bob reveals his bit b first. W.l.o.g., we may assume that Alice would like to 
bias the coin towards 0. She therefore sends a = b in the part of her state where her entangled qutrit is 
not equal to b + 1 (which corresponds to a commitment which she cannot change). We will consider the 
residual state after Alice has sent back k — i signs, in reverse order. This is the unnormalised part of the 
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state (||) that has not been rejected by Bob. We will prove by induction that Alice can locally transform 
the residual state to a state \4>t) after every two rounds of sign exchange. This state is similar in form to 
the joint state (||) above, except that the first part is projected onto the space where x = b, and there is a 
factor of fii in the last term. The state \4>%) is displayed below: 



i-1 

E 

3=1 



i-1 

+ E 

3=1 



3-1 



v 7 ! - A/ |oo; 



1=1 




6 + 1, 6 + D ® 



1 

71 



(|0)h/,(6,0)) + |1)|^(6,1))) 



i-3 



(vT^|o) 



3-1 



i-1 



hKMa)) 



1=3 



i=i 



V2 



(10)1-0(6,0)) + |1}|^(6,1)}) 



(10) 



3-1 



[(-l) S2 ^e\b + l)] 



i-1 



i-1 



vT^ahoo; 



L/=i 




tfifl -A,;) 100) + ^/y |6+1,6+1) 




i-1 



where the numbers m are as follows: 

fJ-k = 
fJ-i-i = 

We can now also specify the parameters A^: 

A; 



1 

(l- € ) 2 ^ + l(3- e ). 



6/2 



Hi(l-e) + e/2 



fill 



(12) 



Clearly, the state | when none of the signs have been revealed by Alice is of this form, with /ij. = 1. 
Assume that this is also the case for some i < k. We will show by induction that the state after Alice has 
revealed k — i + 1 sign bits S2fc-i> S2k-3, ■ ■ ■ , S2i-l may be transformed to (|l0|) and that equation (|ll|) holds. 

To send the sign s^i-i, Alice does the following. The sign in part of the state in the first two summations 
of the state |</>j) in equation (|To|)) is "pre-computed" (in the sign qubit). To compute the sign in the last 
term, Alice first sets b + 1 to 1 in the i-th entangled qutrit, does a Hadamard transform, and exchanges 
that entangled qubit with the i-th sign qubit. She then measures the i-th sign qubit, and sends it across. 
It is easily seen that the unnormalised state that remains after Bob has checked the i-th qutrit sent by 
Alice is as follows. Here, we have written the last terms of the first two summations in equation ( |lO|) 
separately in lines 5 and 7 to facilitate the rest of the proof. 



i-1 


"i-i 


<8> JS|6 + 1,6 + 1) ® 


E 


®Vl-Aj|00) 


3=1 


i=i 





— (10)1^0)) + 11)1^1))) 



i-l- 



2 Actually, the state is a mixture of two states which are both l/y2 times the state given. The mixture arises because of 
the two possible values of the sign bit Alice sends for sgi-i. The mixture is of course equivalent to the single state shown. 
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®(vT=7|0) 



i-2 

+ E 



(g)yr^|oo) 



i-i 
1 



i-l 

®l^(6,*a)) 



(VT^|0)) ® [(-i)^|6 + i)] 



i-l 



MM2l)> 



+ 



i-2 



(g) tt^a; i oo) 



A 



i-l 



2 

i-2 



16+1,6 + 1) 



(Vr^io))* ®iv(6,* 2 (i-i))> 



+ 



i-2 



(g) Vl-A/100) 



+ 



i=i 



i-2 



1 - A,_! |00)) 



®(vT=i|0)) 1 2 ® [(-1) S2 (- 1 )^|6 + 1)] 



(g) v/T 3 ^ I oo) 



.1=1 



1 - A,_! 1 00) 



(vT=7|0>y 2 VT^|0)(^(l-e)+e/2) 1 / 2 



Now, when Bob sends the sign S2(i-i) to Alice, she rotates the (i — l)-th qutrit that Bob sent her in all 
but the last two terms in the sum above, to |0). She also rotates that qutrit in the last two terms from 

(^(l-e)+e/2) 1 / 2 VT^|0) + (-1)^-D^|6+1) 

to ^//j_i|0), whereby = jUj(l — e) 2 + e(l — e)/2 + e. This proves the induction step. 

At the final round of the protocol V n , the state that they are left with is 



/xi(l-Ai)|00) + \/y |6 + 1,6 + 1). 
Following Alice's strategy for computing the sign as above, we see that the probability with which Alice 

/ /i 1 (l-A 1 )(l-e) + v /Aie/2) = /^(l - e) + e/2. (13) 



succeeds in passing Bob's checks is (using equation (12)) 



Solving the recurrence for \n given in equation (|Tl|), we get 
and so that from equation (|l3|), 



( l_ e) 2(^) + ^_| (1 _ (l _ e) 2 M)) 



Fornodd, A n {e) > | + (1 - e)" + (3 ^ e) (1 - (1 - e)"- 1 ) 



1 



2(2 - e 



■(3- 2e + (1 - e 



(14) 
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The analysis in the case that n = 2k is even is similar, except for the rule Alice uses to compute the bit 
she sends to Bob (since she is supposed to reveal her bit before Bob reveals his bit). In this case, she sends 
the bit x if any of her entangled qutrits is in state \x + 1). Else, if any of Bob's qutrits is in state 6 + 1, 
she sends b. In the remaining case, she sends 0, 1 with equal amplitude l/y/2. This leads to a state similar 
to \4>k) above after Bob reveals his bit, and the last sign he used, except that here /z^ = (1 + e)/2. So, we 
get: 

For n even, A n (e) > \ + (1 - ef-\l + e)/2 + (3 ~ ^ ~ " ] (1 - (1 - e)"~ 2 )) 

' -(3-2e-(l-e) n+1 ). (15) 



2(2 - 

From equations (14), ([[!), and we can deduce lower bounds for B n (e) as well, for n > 2. This 
expression matches the one for B\(e). Thus, 

For all n, B n (e) > ^L_(3 - e + (-1)™(1 - 6)" +1 ). (16) 

To determine the bias achieved, we examine the maximum of the cheating probabilities attained by Alice 
and Bob. Note that A n (e) + B n (e) > 3/2 for all n,e. Thus, the bias of the protocol V n is at least 3/4 for 
any n and e. Since we would like this bias to be as small as possible, we optimise the maximum cheating 
probability with respect to e. 

For odd n, A n (0) = B n (l) = 1, and A n (l) = B(0) = 1/2, A n is monotonically decreasing, and B n is 
monotonically increasing with respect to e G [0,1]. Thus, the maximum bias achievable is minimised 
when A n (e) = B n (e). This condition is satisfied when e = eo such that 

(l-6 ) n+1 = | that is, (17) 

eo = (Inn — lnlnn + 0(1)). 

n+1 

Using equation ( |T7| ) we can verify that the lower bound on ^4 n (eo) is 3/4. 

For even n, ^4 ra (0) = A n (l) = 1/2, and -B(O) = B n (l) = 1, A n is concave, B n is convex, and B n (e) > A n (e) 
for e G [0, 1]. Thus, the bias achievable is minimised when B n is, i.e., for e = eo such that 

(l-e ) n = To Vn thatis ' ( 18 ) 

(2 - e )n + 1 

e = -ln(2n-lnn + 9(l)). 

n 

The expression for the cheating probability B n (eo) then evaluates to at least |, as may be seen by using 
equation (|l8|). 

This completes the analysis of the cheating strategies devised above. 
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